Cryptography & Data Protection Flashcards
7 cards from real SDL practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Cryptography & Data Protection flashcards as text
Which cryptographic algorithm is considered most suitable for encrypting data at rest according to SDL best practices?
Answer: AES-256 in CBC or GCM mode
AES-256 in CBC or GCM mode provides strong symmetric encryption approved by NIST and recommended by SDL guidelines for protecting data at rest.
In SDL, what is the primary purpose of using a Hash-based Message Authentication Code (HMAC)?
Answer: To verify both integrity and authenticity of a message
HMAC uses a shared secret key combined with a hash function to ensure both the integrity and the authenticity of a message.
Which key exchange protocol is commonly recommended in SDL to establish a shared secret over an insecure channel without transmitting the secret itself?
Answer: Diffie-Hellman (or ECDH) key agreement
Diffie-Hellman (and its elliptic curve variant ECDH) allows two parties to derive a shared secret without ever sending the secret over the channel.
What is the recommended minimum RSA key length for new SDL-compliant applications as of current NIST guidance?
Answer: 2048 bits
NIST SP 800-131A recommends a minimum RSA key length of 2048 bits for new systems to provide adequate security through 2030.
In an SDL context, what does 'salting' a password hash primarily protect against?
Answer: Rainbow table and precomputation attacks
A salt is a unique random value added to each password before hashing, which defeats precomputed rainbow table attacks by making each hash unique.
Which TLS version should SDL-compliant systems deprecate support for to avoid known vulnerabilities?
Answer: TLS 1.0 and TLS 1.1
TLS 1.0 and TLS 1.1 are deprecated due to known vulnerabilities such as POODLE and BEAST; SDL requires disabling these versions.
What is the main security advantage of Authenticated Encryption with Associated Data (AEAD) ciphers like AES-GCM over AES-CBC?
Answer: AEAD provides both confidentiality and integrity in a single operation
AEAD modes like AES-GCM simultaneously provide confidentiality and integrity/authenticity verification, removing the need for a separate MAC.
How this page was made: written with AI tools. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy